Reprogramming "old" Sennheiser SKM 3072-U - Part 2 - I2C

 Understanding what is going on I2C

In the previous step I hooked up my logic analyzer on the I2C to see how the communication inside the mic actually looks like. Partially because I want to understand better how to reprogram the microphones EEPROM but also because I'm just curious and want to see what is really going on.
After powering up the microphone this is the output from I2C.

write to 0x3E ack data: 0xE0 0xC8 0xF0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
write to 0x3E ack data: 0xE0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
write to 0x50 ack data: 0x10 
read to 0x50 ack data: 0x11
write to 0x51 ack data: 0x1A 
read to 0x50 ack data: 0xA9
write to 0x51 ack data: 0xB3 
read to 0x50 ack data: 0x1F
write to 0x51 ack data: 0xAE 
read to 0x50 ack data: 0x03
write to 0x51 ack data: 0xAF 
read to 0x50 ack data: 0x20
write to 0x51 ack data: 0xAC 
read to 0x50 ack data: 0xFC
write to 0x51 ack data: 0xAD 
read to 0x50 ack data: 0x5D
write to 0x51 ack data: 0xC4 
read to 0x50 ack data: 0xFC
write to 0x51 ack data: 0xC5 
read to 0x50 ack data: 0x41
write to 0x50 ack data: 0x14 
read to 0x50 ack data: 0x00
write to 0x50 ack data: 0x11 
read to 0x50 ack data: 0x03
write to 0x51 ack data: 0x1D 
read to 0x50 ack data: 0xBB
write to 0x51 ack data: 0x1E 
read to 0x50 ack data: 0x99
write to 0x51 ack data: 0x1F 
read to 0x50 ack data: 0x8C
write to 0x51 ack data: 0x73 
read to 0x50 ack data: 0x78
write to 0x51 ack data: 0x74 
read to 0x50 ack data: 0x26
write to 0x51 ack data: 0x75 
read to 0x50 ack data: 0xFE
write to 0x7F ack data: 0x5D 0x06 0x83 0xF0
0x37
0xEF
0x88 0x5E 0x26
0xFC
0xE1 0x6F
write to 0x3E ack data: 0xE0 0x00 0x00 0x00 0x00 0x00 0x9F 0x00 0x00 0x00 0x00 0x00 
write to 0x3E ack data: 0xE0 0x00 0xF0 0x00 0x00 0x00 0xFB 0x00 0x00 0x00 0x00 0x90 
write to 0x3E ack data: 0xE0 0x00 0xBF 0x00 0x09 0x00 0x9A 0x00 0x00 0x00 0x00 0xF0 
write to 0x3E ack data: 0xE0 0x00 0xAB 0x00 0x0F 0x00 0xBD 0x0F 0x00 0x00 0x00 0x99 
write to 0x3E ack data: 0xE0 0x00 0xDA 0x00 0x09 0x00 0x00 0x9B 0xF0 0x00 0x00 0xBF 
write to 0x3E ack data: 0xE0 0x00 0x0D 0x00 0x9B 0x00 0x7B 0xFA 0xBF 0x00 0x00 0x09 
write to 0x3E ack data: 0xE0 0x00 0xF0 0x00 0x00 0x00 0xEF 0x0B 0x00 0x00 0x00 0x2F 
write to 0x50 ack data: 0x11 0x03 
write to 0x50 ack data: 0xB1 
read to 0x50 ack data: 0x11
write to 0x50 ack data: 0x73 
read to 0x50 ack data: 0x79
write to 0x50 ack data: 0x74 
read to 0x50 ack data: 0x87
write to 0x50 ack data: 0x75 
read to 0x50 ack data: 0x00
write to 0x50 ack data: 0xB1 
read to 0x50 ack data: 0x11
write to 0x3E ack data: 0xE0 0x00 0xBA 0xFF 0x99 0x00 0xFB 0xDF 0xFA 0xF7 0xBF 0xFF 
write to 0x50 ack data: 0x73 
read to 0x50 ack data: 0x79
write to 0x50 ack data: 0x74 
read to 0x50 ack data: 0x87
write to 0x50 ack data: 0x75 
read to 0x50 ack data: 0x00
write to 0x50 ack data: 0xB1 
read to 0x50 ack data: 0x11
write to 0x3E ack data: 0xE0 0x00 0xBA 0xFF 0x99 0x00 0xFB 0xDF 0xFA 0xF7 0xBF 0xFF 
write to 0x7F ack data: 0x41 0xF0
0x37
write to 0x3E ack data: 0xE0 0x00 0x37 0xFF 0xE3 0x00 0x75 0x61 0x1C 0xF7 0xBF 0x26 
write to 0x50 ack data: 0x73 
read to 0x50 ack data: 0x79
write to 0x50 ack data: 0x74 
read to 0x50 ack data: 0x87
write to 0x50 ack data: 0x75 
read to 0x50 ack data: 0x00
write to 0x50 ack data: 0xB1 
read to 0x50 ack data: 0x11
write to 0x3E ack data: 0xE0 0x00 0xBA 0xFF 0x99 0x00 0xFB 0xDF 0xFA 0xF7 0xBF 0xFF 

Just like this is not very helpful. But I already know there are 3 devices on the bus. EEPROM, PLL and LCD driver. By little bit of playing around I have found out that 0x3E is display since it I can see it changing in the log as I'm pushing the buttons. It even makes lot of sense since you can see quite huge portions of data sent to the address the display has 6 times 8 segment for displaying numbers, 2 dots, 2 times bar graph for audio and RF 8 segments each, RF labels and BAT label. That means 6*8+2+2*8+2= 68 segments. So I would need around 9 bytes to encode it all, naively speaking. So it actually makes sense. And datasheet for it is nowhere to find and since I don't have to care anyway its enough.

There is also mysterious 0x7F which I suspected to be PLL. After looking at the manual I have found out that it need to set on of its inputs LOW in order to accept the data from I2C. So I added next channel to logic analyzer which was hooked to this pin. And started recording.



And surely enough the EN pin was low when CPU was communicating with 0x7F

Then there is 0x50 and 0x51. This actually confused me a lot on the beginning but after all it can be simply put into the phrase RTFM (Read The F* Manual) well, in this case EEPROM datasheet. It truly is EEPROM as suspected and its address is described in the DS. You can change the address by setting high or low two of its inputs. So in theory you may create array of 4 EEPROM using same chip. But in the mic both E1 and E2 are set low, so the address should be 0x50. Then why 0x51? As clear from the table below, the memory is split into two blocks(halves) and by setting last bit of  its address you can choose the block!



Even more detail for the communication can be found in the datasheet.



And that already looks quite familiar. It actually looks identical to what I can see on the bus

write to 0x51 ack data: 0x1A 
read to 0x50 ack data: 0xA9

Parsed it means: Device 0x50 read data from block 1 of address 0x1A, and response with the data 0xA9. 

But in which format are the data stored in the EEPROM and how can they be safely modified?

More in part 3


Komentáře

Okomentovat

Populární příspěvky z tohoto blogu

Bottle Plotter

Obrázek
Bottle Plotter      I have noticed that, it is quite common in group of small wine producers, that they don't use bottle labels. Usually they just draw some basic info on the bottle with special ( Edding ) paint marker. That is how I got this idea. Everybody can get paper label printed, but what about bottle plotter. CNC that would used paint marker as plotter to plot the label directly on the bottle. And with tool-changer you could also have more colors.         I had this idea in my head for some time, but it take me quite long time to do this mental kick-off and start to work on it. Usually, what works for me is that when the mood is right I go outside walking and fully put myself in this trans-like state where I keep iterating on that idea and create first design in my head. But the "mood" was not coming for some time, so once I have found myself forced to drive for 2h alone in car back home. I never tried this while driving, but I have managed to get myself into that
Další informace

Reprogramming "old" Sennheiser SKM 3072-U - Part 1 - Intro

Obrázek
I'm somehow interested in audio production. But not it more my pet hobby, nothing that would generate decent income. This means I usually don't want to spend much of money on the equipment.  Right about now is quite good time to get some old-ish wireless audio equipment for decent price. The reason is that there was change ( info ) in wireless bands and bands that used to be free before are not available for the professional audio anymore. That means that lot of productions are ditching their stuff to buy new one, compatible. But not all the old stuff is useless as some of it can be reprogrammed. There is tight window from 822 to 830 MHz in EU. This window is quite narrow, but at least it should granted all the time for professional audio. Other option is to go below 700Mhz, but then you might get into collision with local TV transmitter. Therefore I settled for the narrow band since I don't plan to use too many transmitters at once and this should work for me well. My movi
Další informace